1340200 - Block subresource requests whose URLs include credentials

Status: RESOLVED DUPLICATE of bug 479038

(Core :: Networking, task, P3)

Description

[Valentin Gosu [:valentin] {{PTO until Nov 1st}}]

A bit of background:
https://github.com/whatwg/fetch/pull/465

This should likely be implemented behind a pref, in case we regress major use cases, such as corporate network, etc.

Comment 1

[Valentin Gosu [:valentin] {{PTO until Nov 1st}}]

Hi Patrick, what are your thoughts on this?

Comment 2

[Patrick McManus [:mcmanus]]

not sure why we would unilaterally do this. is there a reason to do it without coordination?

Comment 3

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 4

[Selena Deckelmann :selenamarie :selena]

https://github.com/whatwg/fetch/pull/465#issuecomment-356784130

Comment 5

[Selena Deckelmann :selenamarie :selena]

Please evaluate performance first, but have a look.

Comment 6

[Valentin Gosu [:valentin] {{PTO until Nov 1st}}]

Attachment: Bug 1340200 - Block subresource requests whose URLs include credentials

Comment 7

[Valentin Gosu [:valentin] {{PTO until Nov 1st}}]

The attached WIP patch blocks subresource requests that include credentials (if those credentials differ from the top level load). I think we also need to handle redirects, but that shouldn't be too difficult.
However, I think we should put off on landing this for now until https://github.com/whatwg/fetch/pull/465 gets merged, and we have proper WPT test coverage for it.
The only browser to have implemented this is Chrome, and they are currently dealing with regressions:
https://bugs.chromium.org/p/chromium/issues/detail?id=731618

Comment 9

[Valentin Gosu [:valentin] {{PTO until Nov 1st}}]

There doesn't seem to be any browser consensus on doing this yet.

Comment 10

[Anne (:annevk)]

It seems the regression against Chrome is closed and this would remove confusing user-facing dialogs. I suspect Johann et al would appreciate it if we did this. If that's the case I'd be happy to get that Fetch PR moving again.

Comment 11

[Johann Hofmann [:johannh]]

Sorry, I may be missing something, are we showing any dialogs for sub-resources with credentials? :)

Comment 12

[Anne (:annevk)]

Sorry, yes, those are indeed different things. What I was thinking of is tracked by bug 647010 I think.

The focus here is primarily reducing opportunities for dictionary attacks. And I think we agree that this would be good, but we were afraid of web compatibility. Now that Chrome has been shipping this for a number of years and the regressions haven't piled up, we should follow I think, unless I'm missing something.

Comment 13

[Johann Hofmann [:johannh]]

FWIW I agree though I don't see this as a top priority (but I'll leave that to Necko folks).

Comment 14

[Randell Jesup [:jesup] (needinfo me)]

Landed by Chrome in ?59? (2017). Flag to still use it anyways removed in 2021. We should probably follow suit.

Comment 15

[Sunil Mayya]

This is duplicate of 479038.